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Abstract 

We present a so-called fuzzy watermarking scheme based on the relative frequency of 
error in observing qubits in a dissimilar basis from the one in which they were written. 
Then we discuss possible attacks on the system and speculate on how to implement this 
watermarking scheme for particular kinds of messages (images, formated text, etc.). 

1 Introduction 

Alice wrote a digital message that she wants to send to her friend Bob.^ And although 
she trusts Bob enough to send him this message, she wants to be sure that he will not 
try to claim its authorship. To accomplish this, Alice will insert a watermark in her 
message that has the following properties jT]: 

1. It is not perceptible. Bob will not notice the presence of the watermark. 

2. It is nondestructable, unless the message is destroyed beyond use in the process. 

3. It is uniquely verifiable by a secret that only Alice has. 

Alice will accomplish this using a watermarking scheme. In the last decade, many 
researchers have proposed schemes of varying quality using classical information theory. 
Quantum information theory, however, has been ignored. Yet it offers capabilities that 
do not exist in classical information theory alone. [21 Combined with the evidence of ad- 
vantages quantum information theory has conveyed to other coding problems 01110 El 5 
we believe that it can improve watermarking schemes, although to the best of our 
knowledge no one has yet published on this topic. 

Here we present a watermarking scheme based on the relative frequency of error in 
observing qubits in a dissimilar basis from the one in which they were written. 

*Thanks to Dan C. Marinescu for his advice on the completion of this paper. 

^Alice and Bob are standard characters used in illustrations of message exchange systems. 
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2 A Quantum Watermarking Scheme 



Alice has some quantum message M that she wants to watermark and changes it to 
M, which contains some watermarking qubits. All qubits \(j)i) G M are written in 
some basis j. To watermark M, Alice observes the qubits where i £ Z, where I 
is the set of bits in M that we will use for watermarking, and writes them back to M 
in a dissimilar basis k, producing M, the watermarked message. M now contains the 
original qubits written in basis j and the watermarking qubits at {(pi) £ M where i G I 
written in basis k, where k ^ j. 

The watermark is created when M is observed in the basis j (we denote this as 
M o j). The watermarking qubits, which are written in basis k, will be observed in 
error of the intended value with a probability of error pe- The watermark is the relative 
frequency of error in the bits Oj G Af o j where i £ Z, where Z and k are the secrets. 

Consider the example in Figure Q where circles represent qubits, dashed lines rep- 
resent basis states, and solid lines represent the current state of a qubit. We begin with 
our message encoded as qubits in A. Then in B the greyed qubits (i.e. Z = 2,3, 4, 6) 
are rewritten in a different, secret basis by Alice. She then sends B to Bob, who in- 
terprets the message as in C because he does not know which qubits are written in 
a different basis. When Bob observes the message, he gets D with some of the wa- 
termarking qubits in error (the dark grey qubits) and some accurately (the light grey 
qubits), producing a fuzzy watermark (see Figure [21 for an example of verification). 

1 2 3 4 5 6 
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Figure 1: The watermarking process 
2.1 Verification 

One day Alice visits Bob's Website and finds a message M' that she believes to be a 
copy of M. Since she watermarked M before sending it to Bob, she can detect if M' is 
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her watermarked M by comparing the bits that result from observing d'^ £ M' o j and 
at G M o j, where i € I. If the relative frequency of error between d[ and a, is very 
nearly the expected probability of error of reading a qubit as if it were written in basis 
j when it was actually written in basis k, the message M' is probably M watermarked 
by Alice. 

We say 'probably' because the strength of the system depends on the probabilities 
associated with observing qubits. For example, a qubit written in a certain basis might 
have a value |(/>) = ao|45°)+ai|135°). When \<j)) is read in a different basis from the one 
it was written, say the ao|0°) + ai|90°) basis, the value of the bit observed will be in 
error at a certain rate. U\4>) = 1|45°) + 0|135°), then \(l>) = ^/a5|0°) + ^/(r5|90°), so the 
probability of error when read in the second basis is 0.5 from the expected value when 
read in the first basis. When given enough of these qubits written in one basis and 
read in another, we can expect the relative frequency of error to approach the expected 
probability of error. Specifically, we require at minimum n bits, where n = a + b s.t. 
^>Pe bits for <pe < 1. 

Returning to the example from Figure Q Figure El shows how Alice would verify 
that D is the same message as A with her watermark. Here Alice compares the two 
messages on the qubits in I and finds the relative frequency of error. In this case, there 
are 2 errors in 4 bits, for a relative frequency of 0.5. Since we can assume from Figure 
nthat Pe = 0.5, Alice has verified that D is a watermarked A. 
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Figure 2: The watermark verification process 

Clearly this example's message is far too short to be watermarked in the real world, 
but it demonstrates the system. We discuss real world use in the next section. 

2.2 Discussion 

The system is intended to be used in the following way. Alice has a message made 
of qubits or a classical message that she converts to qubits. After inserting the wa- 
termarking qubits, she can either observe the message immediately and only send the 
classical version out, or leave the message in qubit form and let Bob observe the qubits. 
Note that the watermark is not actually created until observation, so it is probably 
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best for Alice to only send out a pre-observed version of the watermarked message to 
avoid the averaging attack (see Attacks below). 

X should be chosen such that if en 7^ a^, the message is not perceptibly changed, and 
such that the watermark cannot be easily removed by non-destructive manipulations. 
Also, X can be chosen according to some secret key K such that only the holder of K 
will be able to find X within a reasonable amount of time, although in reality X is the 
secret that must be kept; is a subsidiary secret that can be used for convenience 
given a reliable function f : K ^ X. 

The key to the effectiveness of this system is in the choice of X and the value of pe- 
The errors the system will introduce must be imperceptible, else an attacker may be 
able to locate enough of X to disable the watermark without destroying M. Also, the 
size of X is important, because if it is too small the relative frequency of error between 
a'- and Oj will not reliably converge on p^. As stated earlier, \X\ > n, n = a + b s.t. 

> Pe, but in general \X\ should be much greater than n to improve the reliability 
and robustness of the watermark (the exact number will vary with message format 
and how close the relative frequency of error must come to the expected probability of 
error). 

Obviously, this scheme is equivalent to a classical scheme that flips the bits S M 
for i € X with a certain probability pg. The advantage of the quantum version is 
that, unlike the classical, it does not rely on a pseudo random number generator, or 
PRNG. PRNGs need to collect entropy from many low-entropy sources since high- 
entropy sources, like radioactive decay, are generally unavailable, thus the quality of 
random numbers may suffer. f?| Further, as Kelsey et al. have shown f8|, most PRNG 
do not produce good random numbers, making it easier to crack implementations of 
coding schemes that use them. Depending on the size and number of messages being 
watermarked, the scheme may suffer because there is not enough entropy to generate 
real random numbers. A quantum system, though, relies on the physical randomness of 
observing a qubit with an ambiguous state. We obtain real randomness from quantum 
observation that does not run out of entropy the way a PRNG does. This is the key 
advantage over a purely classical version of this scheme. 

Using qubits as RNGs depends on a nondeterministic quantum theory. If it turns 
out that the observation of qubits is determined by hidden variables or other factors, 
this scheme (and others that depend on qubits for randomness) may break. 

3 Attacks 

Alice should be careful not to release multiple watermarkings of the message (that is 
to say, more than one M for a particular M). Bob could use these multiple versions 
to average the watermarked messages to approximate or even find the original, unwa- 
termarked, message. This is possible because for each a- S M' o j where i £ X there 
is only a difference from with a probability of pe- If he can get enough versions of 
M, he can find most if not all of X by looking at where the bits differ and, guessing 
k, average the values of the watermarking bits to produce a version of the message 
without a valid watermark but imperceptibly different from the original. This attack 
might be made harder if X varies for each M for a particular M, however it would not 
completely eliminate the possibility of successful averaging. 

If |X| is too small, a sufficient but imperceptible amount of noise will reduce the 
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number of intact a'^ G M' o j such that the relative frequency of error wih not rehably 
approach the expected probabihty of error. This happens because the scheme depends 
on the frequency with which a, disagrees with en, so if some of M[ are changed, the 
relative frequency of error may no longer approach pe- The best defense against this is 
to increase \I\ , but not to the point that the watermark becomes perceptible. It should 
be that the noise needed to disable the watermark will render the message useless. 

Attacks that do not damage the message but change the indices of bits by padding 
the message with nondestructive bits are particularly damaging. For example, de- 
pending on the format of the message, it may be that the bits ao, ai, 02, • • • , for 
Oi G M can be shifted +1, so that di becomes Oj+i and do receives a value that is 
imperceptible or ignored by the format. Defeating this attack is nontrivial, because it 
requires recognizing how the bits in the message have been transformed and reversing 
the transformation so that the indices Oj and d'- match up. 

4 Implementation 

We have not said anything regarding how Z should be chosen. This is particular to the 
kind of message (image, formatted text, audio, etc.) and the required robustness, al- 
though some formats are more likely to accommodate this fuzzy watermarking scheme. 
Images and audio, for example, have room for imperceptible noise. Video, in some 
cases, has enough room to allow steganographic audio to be transmitted, which pro- 
vides more than enough room for a fuzzy watermark. ^ These message types provide 
plenty of room for our watermarking scheme. Conversely, text, even formatted text, 
may be too fragile for this system, quickly dissolving into perceptible noise. 

Ultimately, we leave it as an exercise for those who wish to implement this scheme 
with a particular format to decide how to choose I. 

5 Conclusion 

Quantum watermarking is a new-born subfield of the young field of digital watermark- 
ing. Although the first steps taken in this paper do not provide stunning results like 
those found in quantum cryptography, this may change in the near future. 
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